Resource exhaustion in Sqlparse - CVE-2023-30608

Vulnerability identifier: #VU75412

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30608

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Sqlparse
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
openSUSE Leap Micro
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
Fedora
Oracle Solaris
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Public Cloud Module
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Package Hub 15
Basesystem Module
Python 3 Module
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
python311-google-cloud-kms-inventory
python-sqlparse
python-sqlparse (Ubuntu package)
python3-sqlparse (Ubuntu package)
python2-sqlparse
python311-google-cloud-audit-log
python311-pyasn1-modules
python-sqlparse-help
python3-sqlparse
python-sqlparse (Red Hat package)
python311-sqlparse
python311-pyasn1
python311-google-cloud-run
python311-grpc-google-iam-v1
python311-google-cloud-dns
libcrc32c1
libcrc32c1-debuginfo
libcrc32c-debugsource
libcrc32c-devel
python311-google-cloud-appengine-logging
python311-google-crc32c
python-google-crc32c-debugsource
python311-google-crc32c-debuginfo
python311-google-cloud-domains
python311-google-cloud-vpc-access
python311-google-cloud-artifact-registry
python311-py
python311-google-cloud-service-directory
python311-google-cloud-compute
python311-cffi-debuginfo
python311-cffi
python-cffi-debugsource
python311-proto-plus
python311-grpcio-status
python-grpcio-debugsource
python311-grpcio-debuginfo
python311-grpcio
python311-googleapis-common-protos
python311-iniconfig
python311-urllib3
python311-google-cloud-core
python311-google-resumable-media
python311-google-cloud-iam
python311-google-cloud-storage
python311-google-api-core
python311-google-cloud-secret-manager
python311-google-cloud-kms
python311-pycparser
python311-google-auth
python311-requests
python311-apipkg
python311-charset-normalizer
python-django (Red Hat package)
python311-idna
python311-google-cloud-logging
python311-google-cloud-build
python311-google-cloud-spanner
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
python311-rsa
python311-protobuf
python311-cachetools
python311-pyOpenSSL
protobuf-debugsource
libprotobuf25_1_0-32bit
libprotoc25_1_0-32bit
protobuf-java
libprotoc25_1_0-debuginfo
libprotobuf-lite25_1_0-32bit
libprotobuf-lite25_1_0-debuginfo
libprotobuf-lite25_1_0
protobuf-devel
libprotoc25_1_0-32bit-debuginfo
libprotoc25_1_0
libprotobuf25_1_0
libprotobuf25_1_0-32bit-debuginfo
protobuf-devel-debuginfo
libprotobuf-lite25_1_0-32bit-debuginfo
libprotobuf25_1_0-debuginfo
libprotobuf25_1_0-64bit
libprotoc25_1_0-64bit
libprotobuf-lite25_1_0-64bit
libprotobuf-lite25_1_0-64bit-debuginfo
libprotoc25_1_0-64bit-debuginfo
libprotobuf25_1_0-64bit-debuginfo
python311-cryptography
python311-cryptography-debuginfo
python-cryptography-debugsource
python311-setuptools-wheel
python311-setuptools
python311-pytz
python311-certifi
Storage Resource Manager
Dell EMC Storage Monitoring and Reporting (SMR)
Red Hat Satellite

Install update from vendor's website.

Sqlparse - update to 0.4.4
python311-google-cloud-kms-inventory - update to 0.2.2-150400.9.3.1
python-sqlparse - addressed in versions 0.2.3-3.3.1, 0.2.3-4.3.1
python-sqlparse (Ubuntu package) - update to 0.2.4-0.1ubuntu0.1
python3-sqlparse (Ubuntu package) - addressed in versions 0.2.4-3ubuntu0.1, 0.4.2-1ubuntu0.22.04.1, 0.4.2-1ubuntu0.22.10.1, 0.4.2-1ubuntu0.23.04.1
python2-sqlparse - update to 0.2.4-150100.6.3.1
python311-google-cloud-audit-log - update to 0.2.5-150400.9.3.1
python311-pyasn1-modules - update to 0.3.0-150400.12.7.1
python-sqlparse - update to 0.3.1-2
python-sqlparse-help - update to 0.3.1-2
python3-sqlparse - update to 0.3.1-2
python-sqlparse - addressed in versions 0.4.2-14.el9, 0.4.2-14.fc42
python3-sqlparse - update to 0.4.2-150300.3.6.1
python-sqlparse (Red Hat package) - update to 0.4.4-1.0.1.el8ui
python311-sqlparse - update to 0.4.4-150400.6.4.2
python311-pyasn1 - update to 0.5.0-150400.12.7.2
python311-google-cloud-run - update to 0.10.1-150400.9.3.1
python311-grpc-google-iam-v1 - update to 0.13.0-150400.9.3.1
python311-google-cloud-dns - update to 0.35.0-150400.9.3.1
libcrc32c1 - update to 1.1.2-150400.9.3.1
libcrc32c1-debuginfo - update to 1.1.2-150400.9.3.1
libcrc32c-debugsource - update to 1.1.2-150400.9.3.1
libcrc32c-devel - update to 1.1.2-150400.9.3.1
python311-google-cloud-appengine-logging - update to 1.4.0-150400.9.3.1
python311-google-crc32c - update to 1.5.0-150400.9.3.1
python-google-crc32c-debugsource - update to 1.5.0-150400.9.3.1
python311-google-crc32c-debuginfo - update to 1.5.0-150400.9.3.1
python311-google-cloud-domains - update to 1.7.1-150400.9.3.1
python311-google-cloud-vpc-access - update to 1.10.0-150400.9.3.1
python311-google-cloud-artifact-registry - update to 1.11.0-150400.9.3.1
python311-py - update to 1.11.0-150400.12.7.2
python311-google-cloud-service-directory - update to 1.11.1-150400.9.3.1
python311-google-cloud-compute - update to 1.15.0-150400.9.3.1
python311-cffi-debuginfo - update to 1.15.1-150400.8.7.2
python311-cffi - update to 1.15.1-150400.8.7.2
python-cffi-debugsource - update to 1.15.1-150400.8.7.2
python311-proto-plus - update to 1.23.0-150400.9.3.1
python311-grpcio-status - update to 1.60.1-150400.9.3.1
python-grpcio-debugsource - update to 1.60.1-150400.9.7.2
python311-grpcio-debuginfo - update to 1.60.1-150400.9.7.2
python311-grpcio - update to 1.60.1-150400.9.7.2
python311-googleapis-common-protos - update to 1.62.0-150400.10.4.1
python311-iniconfig - update to 2.0.0-150400.10.6.1
python311-urllib3 - update to 2.0.7-150400.7.14.1
python311-google-cloud-core - update to 2.4.1-150400.5.4.1
python311-google-resumable-media - update to 2.7.0-150400.10.4.1
python311-google-cloud-iam - update to 2.13.0-150400.9.3.1
python311-google-cloud-storage - update to 2.14.0-150400.10.3.1
python311-google-api-core - update to 2.15.0-150400.5.4.1
python311-google-cloud-secret-manager - update to 2.17.0-150400.9.3.1
python311-google-cloud-kms - update to 2.21.0-150400.9.3.1
python311-pycparser - update to 2.21-150400.12.7.2
python311-google-auth - update to 2.27.0-150400.6.7.1
python311-requests - update to 2.31.0-150400.6.8.1
python311-apipkg - update to 3.0.1-150400.12.6.1
python311-charset-normalizer - update to 3.1.0-150400.9.7.2
python-django (Red Hat package) - update to 3.2.19-1.0.1.el8ui
python311-idna - update to 3.4-150400.11.6.1
python311-google-cloud-logging - update to 3.9.0-150400.9.3.1
python311-google-cloud-build - update to 3.22.0-150400.9.3.1
python311-google-cloud-spanner - update to 3.40.1-150400.9.3.1
rhui-installer (Red Hat package) - update to 4.5.0.1-1.el8ui
rhui-tools (Red Hat package) - update to 4.5.0.5-1.el8ui
python311-rsa - update to 4.9-150400.12.7.1
python311-protobuf - update to 4.25.1-150400.9.6.1
Storage Resource Manager - update to 5.0.2.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.2.0
python311-cachetools - update to 5.3.1-150400.8.6.1
Red Hat Satellite - update to 6.14
python311-pyOpenSSL - update to 23.2.0-150400.3.10.1
protobuf-debugsource - update to 25.1-150400.9.6.1
libprotobuf25_1_0-32bit - update to 25.1-150400.9.6.1
libprotoc25_1_0-32bit - update to 25.1-150400.9.6.1
protobuf-java - update to 25.1-150400.9.6.1
libprotoc25_1_0-debuginfo - update to 25.1-150400.9.6.1
libprotobuf-lite25_1_0-32bit - update to 25.1-150400.9.6.1
libprotobuf-lite25_1_0-debuginfo - update to 25.1-150400.9.6.1
libprotobuf-lite25_1_0 - update to 25.1-150400.9.6.1
protobuf-devel - update to 25.1-150400.9.6.1
libprotoc25_1_0-32bit-debuginfo - update to 25.1-150400.9.6.1
libprotoc25_1_0 - update to 25.1-150400.9.6.1
libprotobuf25_1_0 - update to 25.1-150400.9.6.1
libprotobuf25_1_0-32bit-debuginfo - update to 25.1-150400.9.6.1
protobuf-devel-debuginfo - update to 25.1-150400.9.6.1
libprotobuf-lite25_1_0-32bit-debuginfo - update to 25.1-150400.9.6.1
libprotobuf25_1_0-debuginfo - update to 25.1-150400.9.6.1
libprotobuf25_1_0-64bit - update to 25.1-150400.9.6.1
libprotoc25_1_0-64bit - update to 25.1-150400.9.6.1
libprotobuf-lite25_1_0-64bit - update to 25.1-150400.9.6.1
libprotobuf-lite25_1_0-64bit-debuginfo - update to 25.1-150400.9.6.1
libprotoc25_1_0-64bit-debuginfo - update to 25.1-150400.9.6.1
libprotobuf25_1_0-64bit-debuginfo - update to 25.1-150400.9.6.1
python311-cryptography - update to 41.0.3-150400.16.19.1
python311-cryptography-debuginfo - update to 41.0.3-150400.16.19.1
python-cryptography-debugsource - update to 41.0.3-150400.16.19.1
python311-setuptools-wheel - update to 67.7.2-150400.3.12.1
python311-setuptools - update to 67.7.2-150400.3.12.1
python311-pytz - update to 2023.3-150400.6.6.1
python311-certifi - update to 2023.7.22-150400.12.6.2

• https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
• https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
• https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
• https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a

• Denial of service in sqlparse
• Ubuntu update for sqlparse
• SUSE update for python-sqlparse
• SUSE update for python-sqlparse
• SUSE update for python-sqlparse
• SUSE update for python-sqlparse
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI) 4.5
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Red Hat Satellite 6.14
• openEuler update for python-sqlparse
• SUSE update for Recommended update for google-cloud SDK
• SUSE update for Recommended update for google-cloud SDK
• SUSE update for Recommended update for google-cloud SDK
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Fedora EPEL 9 update for python-sqlparse
• Fedora 42 update for python-sqlparse